Data Protection Impact Assessment

Conducted: April 3, 2026 · Review due: October 3, 2026

This Data Protection Impact Assessment (DPIA) is conducted in accordance with GDPR Article 35 to evaluate and mitigate risks associated with the processing of personal financial data by forvalt.

1. Project Overview

Item	Details
Project name	forvalt — Personal Wealth Planning App
Data controller	forvalt (independent operator)
Contact	@forvalt_bot → /support
Assessment date	April 3, 2026
Next review	October 3, 2026 (or upon significant changes)

2. Why This DPIA Is Required

This DPIA is required because the processing involves:

Financial data at scale — income, expenses, savings, investments, and asset values
Profiling — generating financial projections and analysis based on personal data
Cross-border transfers — data transmitted to US-based processors (Groq, Stripe)
Automated processing — AI-powered financial advice based on user data

3. Data Processing Activities

3.1 Core financial planning

Aspect	Details
Data categories	Date of birth, income, expenses, savings, goals, assets, investments
Data subjects	App users (individuals planning personal finances)
Purpose	Generate financial projections and wealth tracking
Processing location	Client-side (browser) — calculations run locally
Storage	localStorage (device) + encrypted blob in Supabase (EU)
Lawful basis	Contract (providing the service)

3.2 AI financial advisor

Aspect	Details
Data categories	Financial snapshot (income, expenses, goals, assets) + user questions
Purpose	Generate personalized financial guidance
Processor	Groq (United States)
Retention by processor	Not retained after processing (per Groq's terms)
Lawful basis	Consent (user explicitly initiates each query)

3.3 Payment processing

Aspect	Details
Data categories	Telegram ID, username, subscription plan
Purpose	Process Premium subscription payments
Processor	Stripe (United States)
Lawful basis	Contract (processing payment for requested service)

3.4 Analytics

Aspect	Details
Data categories	Bucketed capital ranges, bucketed savings rates, session IDs, feature counters
Purpose	Product improvement and usage understanding
Processing location	Redis Cloud (EU, Frankfurt)
Retention	48 hours (daily counters), 30 minutes (sessions)
Lawful basis	Legitimate interest (with opt-out available)

4. Risk Assessment

Risk	Likelihood	Impact	Risk level	Mitigation
Database breach exposing financial data	Low	High	Low (mitigated)	All financial data is AES-256-GCM encrypted on the client. Server stores only encrypted ciphertext. Even full database access yields unreadable data.
Encryption key compromise	Very low	High	Low	Keys are derived from Telegram ID + salt (or user passphrase) using PBKDF2 with 100K iterations. Keys never leave the client device. Optional passphrase adds zero-knowledge protection.
Unauthorized admin access	Low	Medium	Low	Admin access restricted to allowlisted Telegram IDs. All admin actions logged in immutable audit trail. Rate limiting on admin endpoints.
Cross-border transfer to Groq (US)	Medium	Medium	Medium	Data sent only on explicit user action. Not retained by Groq after processing. Belarus users require explicit consent. UI discloses the transfer before use.
Stripe payment data exposure	Low	Medium	Low	Only Telegram ID and username shared. Stripe handles payment card data directly. Webhook signatures verified cryptographically.
Analytics re-identification	Very low	Low	Low	Only bucketed ranges transmitted (not exact values). No PII in analytics. Users can opt out entirely.
localStorage data theft (XSS)	Low	High	Medium	Telegram Mini App sandbox limits XSS vectors. No third-party scripts loaded. CSP headers restrict script sources. Optional passphrase encryption protects local data.
Denial of data access/deletion	Very low	Medium	Low	Users have self-service export (JSON/CSV) and deletion. No admin intervention required. Rate-limited to prevent abuse.

5. Mitigations Summary

Privacy by Design measures already implemented:

Client-side encryption — AES-256-GCM with PBKDF2-SHA256 (100K iterations). Server is zero-knowledge by default.
Data minimization — analytics use bucketed ranges, not exact values. Profile photos and AI chat not synced to server.
Purpose limitation — each data field has a documented purpose. No data repurposing.
Self-service rights — export (JSON/CSV), deletion, restriction (freeze), and analytics opt-out available in-app.
Authentication — HMAC-SHA256 verification of Telegram initData. No password-based auth for users.
Admin controls — allowlisted IDs, append-only audit log, rate limiting, no bulk data export of decrypted data.
Transparency — comprehensive privacy policy, AI advisor data transfer disclosure, consent flow for Belarus users.
Retention limits — analytics 48h, sessions 30m, audit logs 7 years, user data until deletion request.

6. Residual Risks

After mitigations, the following residual risks remain at acceptable levels:

Groq data handling — reliance on Groq's privacy commitments for AI query processing. Mitigated by sending only on user action and not retaining data server-side.
Telegram platform dependency — user identity tied to Telegram. If Telegram account is compromised, attacker could access encrypted data (unless passphrase is set).
localStorage persistence — unencrypted local data accessible if device is compromised. Mitigated by optional passphrase encryption.

7. Conclusion

The overall risk to data subjects is low after implementing the identified mitigations. The client-side encryption architecture ensures that even a complete server-side breach would not expose readable financial data. The processing is proportionate to the legitimate purposes of providing a personal financial planning service.

This DPIA will be reviewed every 6 months or when significant changes are made to data processing activities.

8. Approval

Role	Name	Date
Data Controller / Operator	forvalt operator	April 3, 2026